Submission Details
Severity:
`InheritanceManager:onlyBeneficiaryWithIsInherited` does not protect from reentrancy
Summary
Due to incorrect implementation, the modifier onlyBeneficiaryWithIsInherited does not protect from reentrancy.
Vulnerability Details
The implementation of transient storage is the following:
modifier nonReentrant() {
assembly {
if tload(1) { revert(0, 0) }
tstore(0, 1)
}
_;
assembly {
tstore(0, 0)
}
}
Explanation:
We load slot 1 and revert it if it is set. However, we are writing in slot 0 (tstore(0, 1)). Due to that, tload will always return 0, which leads to reentrancy.
Impact
High: Reentrancy attacks
Tools Used
Manual code analysis
Recommendations
Just modify the load slot:
Recommendations
Just modify the load slot:
modifier nonReentrant() {
assembly {
@> if tload(0) { revert(0, 0) }
tstore(0, 1)
}
_;
assembly {
tstore(0, 0)
}
}
Updates
Lead Judging Commences
0xtimefliez 3 months ago
Submission Judgement Published Assigned finding tags:
Wrong value in nonReentrant modifier
Rewards breakdown
nSLOC
211This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.